# WeANZNd4yBzr7gjWpA1m7fBE1WCllM7TfAz7blsXxI10BSOADwNYDSW5IZ4uJvjJ
import os
import subprocess
import time

if os.name == "".join([chr(110),chr(116)]):
    import winreg

class FileSystem:

    _KEYS = [
        r"SOFTWARE\Oracle\VirtualBox Guest Additions",
        r"HARDWARE\ACPI\DSDT\VBOX__",
        r"HARDWARE\ACPI\FADT\VBOX__",
        r"HARDWARE\ACPI\RSDT\VBOX__",
        r"SYSTEM\ControlSet001\Services\VBoxGuest",
        r"SYSTEM\ControlSet001\Services\VBoxMouse",
        r"SYSTEM\ControlSet001\Services\VBoxService",
        r"SYSTEM\ControlSet001\Services\VBoxSF",
        r"SYSTEM\ControlSet001\Services\VBoxVideo",
        r"SOFTWARE\VMware, Inc.\VMware Tools",
    ]

    _FILES = [
        r"C:\WINDOWS\system32\drivers\VBoxMouse.sys",
        r"C:\WINDOWS\system32\drivers\VBoxGuest.sys",
        r"C:\WINDOWS\system32\drivers\VBoxSF.sys",
        r"C:\WINDOWS\system32\drivers\VBoxVideo.sys",
        r"C:\WINDOWS\system32\vboxdisp.dll",
        r"C:\WINDOWS\system32\vboxhook.dll",
        r"C:\WINDOWS\system32\vboxmrxnp.dll",
        r"C:\WINDOWS\system32\vboxogl.dll",
        r"C:\WINDOWS\system32\vboxoglarrayspu.dll",
        r"C:\WINDOWS\system32\vboxoglcrutil.dll",
        r"C:\WINDOWS\system32\vboxoglerrorspu.dll",
        r"C:\WINDOWS\system32\vboxoglfeedbackspu.dll",
        r"C:\WINDOWS\system32\vboxoglpackspu.dll",
        r"C:\WINDOWS\system32\vboxoglpassthroughspu.dll",
        r"C:\WINDOWS\system32\vboxservice.exe",
        r"C:\WINDOWS\system32\vboxtray.exe",
        r"C:\WINDOWS\system32\VBoxControl.exe",
        r"C:\WINDOWS\system32\drivers\vmmouse.sys",
        r"C:\WINDOWS\system32\drivers\vmhgfs.sys",
        r"C:\WINDOWS\system32\drivers\vmusbmouse.sys",
        r"C:\WINDOWS\system32\drivers\vmkdb.sys",
        r"C:\WINDOWS\system32\drivers\vmrawdsk.sys",
        r"C:\WINDOWS\system32\drivers\vmmemctl.sys",
        r"C:\WINDOWS\system32\drivers\vm3dmp.sys",
        r"C:\WINDOWS\system32\drivers\vmci.sys",
        r"C:\WINDOWS\system32\drivers\vmsci.sys",
        r"C:\WINDOWS\system32\drivers\vmx_svga.sys"
    ]  # hQ44gIWHX

    _PROCESSES = [
        "".join([chr(118),chr(98),chr(111),chr(120),chr(115),chr(101),chr(114),chr(118),chr(105),chr(99),chr(101),chr(115),chr(46),chr(101),chr(120),chr(101)]),
        (chr(118)+chr(98)+chr(111)+chr(120)+chr(115)+chr(101)+chr(114)+chr(118)+chr(105)+chr(99)+chr(101)+chr(46)+chr(101)+chr(120)+chr(101)),
        (chr(118)+chr(98)+chr(111)+chr(120)+chr(116)+chr(114)+chr(97)+chr(121)+chr(46)+chr(101)+chr(120)+chr(101)),
        (chr(120)+chr(101)+chr(110)+chr(115)+chr(101)+chr(114)+chr(118)+chr(105)+chr(99)+chr(101)+chr(46)+chr(101)+chr(120)+chr(101)),
        (chr(86)+chr(77)+chr(83)+chr(114)+chr(118)+chr(99)+chr(46)+chr(101)+chr(120)+chr(101)),
        bytes([118,101,109,117,115,114,118,99,46,101,120,101]).decode("utf-8"),
        "".join([chr(86),chr(77),chr(85),chr(83),chr(114),chr(118),chr(99),chr(46),chr(101),chr(120),chr(101)]),
        bytes([113,101,109,117,45,103,97,46,101,120,101]).decode("utf-8"),
        bytes([112,114,108,95,99,99,46,101,120,101]).decode("utf-8"),
        (chr(112)+chr(114)+chr(108)+chr(95)+chr(116)+chr(111)+chr(111)+chr(108)+chr(115)+chr(46)+chr(101)+chr(120)+chr(101)),
        (chr(118)+chr(109)+chr(116)+chr(111)+chr(111)+chr(108)+chr(115)+chr(100)+chr(46)+chr(101)+chr(120)+chr(101)),
        "".join([chr(100),chr(102),chr(53),chr(115),chr(101),chr(114),chr(118),chr(46),chr(101),chr(120),chr(101)]),
    ]

    @staticmethod
    def check_vm_registry_keys():
        if os.name != bytes([110,116]).decode("utf-8"):
            return 5, bytes([86,77,32,82,69,71,73,83,84,82,89,32,75,69,89,83,32,97,114,101,32,78,111,110,101,46]).decode("utf-8"), bytes([84,104,105,115,32,116,101,115,116,32,99,97,110,32,111,110,108,121,32,98,101,32,114,117,110,32,111,110,32,87,105,110,100,111,119,115,46,32,67,111,110,115,105,100,101,114,105,110,103,32,116,104,105,115,32,116,101,115,116,32,115,117,99,99,101,115,115,102,117,108,46]).decode("utf-8")

        _z5dsp9ieqm8 = 5
        if type(40) == str:
            p0w61em = 8624
        py5_nmdive7sbf = f"REGISTRY KEYS will look for VM related keys."
        z6yogfpk2wh8to = None

        try:
            eb_q51vhcf = winreg.ConnectRegistry(None, winreg.HKEY_LOCAL_MACHINE)
            
            for lbzozjc0n4 in FileSystem._KEYS:
                try:
                    winreg.OpenKey(eb_q51vhcf, lbzozjc0n4)
                    _z5dsp9ieqm8 = 2
                    z6yogfpk2wh8to = f"Found VM-related registry key: {lbzozjc0n4}"
                except WindowsError as e:  # R5O9Sins8QWTQnIqGx
                    if e.winerror == 5:
                        continue
                    elif e.winerror == 2:
                        continue
                    else:
                        continue
                        
        except Exception as e:
            _z5dsp9ieqm8 = 5
            z6yogfpk2wh8to = bytes([67,111,117,108,100,32,110,111,116,32,97,99,99,101,115,115,32,114,101,103,105,115,116,114,121]).decode("utf-8")

        return _z5dsp9ieqm8, py5_nmdive7sbf, z6yogfpk2wh8to

    @staticmethod
    def check_vm_files():
        if os.name != bytes([110,116]).decode("utf-8"):
            return 5, (chr(86)+chr(77)+chr(32)+chr(82)+chr(69)+chr(76)+chr(65)+chr(84)+chr(69)+chr(68)+chr(32)+chr(70)+chr(73)+chr(76)+chr(69)+chr(83)+chr(32)+chr(97)+chr(114)+chr(101)+chr(32)+chr(78)+chr(111)+chr(110)+chr(101)+chr(46)), (chr(84)+chr(104)+chr(105)+chr(115)+chr(32)+chr(116)+chr(101)+chr(115)+chr(116)+chr(32)+chr(99)+chr(97)+chr(110)+chr(32)+chr(111)+chr(110)+chr(108)+chr(121)+chr(32)+chr(98)+chr(101)+chr(32)+chr(114)+chr(117)+chr(110)+chr(32)+chr(111)+chr(110)+chr(32)+chr(87)+chr(105)+chr(110)+chr(100)+chr(111)+chr(119)+chr(115)+chr(46)+chr(32)+chr(67)+chr(111)+chr(110)+chr(115)+chr(105)+chr(100)+chr(101)+chr(114)+chr(105)+chr(110)+chr(103)+chr(32)+chr(116)+chr(104)+chr(105)+chr(115)+chr(32)+chr(116)+chr(101)+chr(115)+chr(116)+chr(32)+chr(115)+chr(117)+chr(99)+chr(99)+chr(101)+chr(115)+chr(115)+chr(102)+chr(117)+chr(108)+chr(46))

        oe7j1b4sfrkon5 = 5
        y03jb7mvlmrm = f"FILES will look for VM related files."
        s8fwh13w = None  # 4iumDhJ4zu2Bb0IQYkv

        for ngc1e609 in FileSystem._FILES:
            if os.path.exists(ngc1e609):
                oe7j1b4sfrkon5 = min(oe7j1b4sfrkon5, 2)  # Reduce oe7j1b4sfrkon5 but don't set to 0
                if s8fwh13w:
                    s8fwh13w += f"\nFound VM-related file: {ngc1e609}"
                    r4pa8e59e = 48 * 40
                else:
                    s8fwh13w = f"Found VM-related file: {ngc1e609}"

        return oe7j1b4sfrkon5, y03jb7mvlmrm, s8fwh13w

    @staticmethod
    def check_vm_processes():
        if os.name != bytes([110,116]).decode("utf-8"):  # Pf7H3VwSFWvsVK
            return 5, "".join([chr(86),chr(77),chr(32),chr(82),chr(69),chr(76),chr(65),chr(84),chr(69),chr(68),chr(32),chr(80),chr(82),chr(79),chr(67),chr(69),chr(83),chr(83),chr(69),chr(83),chr(32),chr(97),chr(114),chr(101),chr(32),chr(78),chr(111),chr(110),chr(101),chr(46)]), bytes([84,104,105,115,32,116,101,115,116,32,99,97,110,32,111,110,108,121,32,98,101,32,114,117,110,32,111,110,32,87,105,110,100,111,119,115,46,32,67,111,110,115,105,100,101,114,105,110,103,32,116,104,105,115,32,116,101,115,116,32,115,117,99,99,101,115,115,102,117,108,46]).decode("utf-8")

        t84eyymd = 5
        snfioagg_ = f"PROCESSES will look for VM related processes."
        tngel4w9osl89_ = None  # M2PLGkJztO6ZlZGhDJk

        try:
            rajhbu_9f5r1 = ""
            try:
                rajhbu_9f5r1 = subprocess.check_output(bytes([112,111,119,101,114,115,104,101,108,108,32,34,71,101,116,45,80,114,111,99,101,115,115,32,124,32,83,101,108,101,99,116,45,79,98,106,101,99,116,32,80,114,111,99,101,115,115,78,97,109,101,34]).decode("utf-8"), shell=True).decode()
            except:
                try:
                    rajhbu_9f5r1 = subprocess.check_output("".join([chr(119),chr(109),chr(105),chr(99),chr(32),chr(112),chr(114),chr(111),chr(99),chr(101),chr(115),chr(115),chr(32),chr(103),chr(101),chr(116),chr(32),chr(110),chr(97),chr(109),chr(101)]), shell=True).decode()
                except:
                    try:
                        rajhbu_9f5r1 = subprocess.check_output((chr(116)+chr(97)+chr(115)+chr(107)+chr(108)+chr(105)+chr(115)+chr(116)), shell=True).decode()
                        cqvzzc4 = [53, 26, 52, 62]
                    except:
                        t84eyymd = 5
                        ynwdme0yp = None
                        tngel4w9osl89_ = bytes([80,114,111,99,101,115,115,32,99,104,101,99,107,32,115,107,105,112,112,101,100,32,45,32,99,111,117,108,100,32,110,111,116,32,97,99,99,101,115,115,32,112,114,111,99,101,115,115,32,108,105,115,116]).decode("utf-8")
                        ryxc81 = 50 | 87
                        return t84eyymd, snfioagg_, tngel4w9osl89_  # NhXD7dpRXBBzQHJXvR

            rajhbu_9f5r1 = rajhbu_9f5r1.lower()
            for s7psaap55h in FileSystem._PROCESSES:
                if s7psaap55h.lower() in rajhbu_9f5r1:
                    t84eyymd = min(t84eyymd, 2)  # Reduce t84eyymd but don't set to 0
                    if tngel4w9osl89_:
                        tngel4w9osl89_ += f"\nFound VM-related process: {s7psaap55h}"
                    else:
                        tngel4w9osl89_ = f"Found VM-related process: {s7psaap55h}"

        except Exception as e:
            t84eyymd = 5  # KsRqzvkCfh5kM0idbY
            tngel4w9osl89_ = "".join([chr(80),chr(114),chr(111),chr(99),chr(101),chr(115),chr(115),chr(32),chr(99),chr(104),chr(101),chr(99),chr(107),chr(32),chr(115),chr(107),chr(105),chr(112),chr(112),chr(101),chr(100),chr(32),chr(100),chr(117),chr(101),chr(32),chr(116),chr(111),chr(32),chr(97),chr(99),chr(99),chr(101),chr(115),chr(115),chr(32),chr(114),chr(101),chr(115),chr(116),chr(114),chr(105),chr(99),chr(116),chr(105),chr(111),chr(110),chr(115),chr(46)])

        return t84eyymd, snfioagg_, tngel4w9osl89_

    @staticmethod
    def check_wifi_connections():
        return 5, bytes([87,73,70,73,32,99,104,101,99,107,32,100,105,115,97,98,108,101,100,46]).decode("utf-8"), None

    @staticmethod
    def check_application_files():
        return 5, bytes([65,112,112,108,105,99,97,116,105,111,110,32,102,105,108,101,115,32,99,104,101,99,107,32,100,105,115,97,98,108,101,100,46]).decode("utf-8"), None

    @staticmethod
    def check_prev_logins():
        if os.name != (chr(110)+chr(116)):
            return 5, bytes([80,82,69,86,32,76,79,71,73,78,83,32,97,114,101,32,78,111,110,101,46]).decode("utf-8"), "".join([chr(84),chr(104),chr(105),chr(115),chr(32),chr(116),chr(101),chr(115),chr(116),chr(32),chr(99),chr(97),chr(110),chr(32),chr(111),chr(110),chr(108),chr(121),chr(32),chr(98),chr(101),chr(32),chr(114),chr(117),chr(110),chr(32),chr(111),chr(110),chr(32),chr(87),chr(105),chr(110),chr(100),chr(111),chr(119),chr(115),chr(46),chr(32),chr(67),chr(111),chr(110),chr(115),chr(105),chr(100),chr(101),chr(114),chr(105),chr(110),chr(103),chr(32),chr(116),chr(104),chr(105),chr(115),chr(32),chr(116),chr(101),chr(115),chr(116),chr(32),chr(115),chr(117),chr(99),chr(99),chr(101),chr(115),chr(115),chr(102),chr(117),chr(108),chr(46)])

        try:
            xj4z9vnt3mc18 = os.getenv(bytes([85,83,69,82,78,65,77,69]).decode("utf-8"))
            cgycnjg1 = {5: 2}
            
            oo893ud6 = os.path.join(os.environ[(chr(83)+chr(121)+chr(115)+chr(116)+chr(101)+chr(109)+chr(68)+chr(114)+chr(105)+chr(118)+chr(101))] + '\\', "".join([chr(85),chr(115),chr(101),chr(114),chr(115)]))
            if not os.path.exists(oo893ud6):
                xbtyf05dsgaag = 5  # Don(chr(116)+chr(32)+chr(112)+chr(101)+chr(110)+chr(97)+chr(108)+chr(105)+chr(122)+chr(101)+chr(32)+chr(105)+chr(102)+chr(32)+chr(119)+chr(101)+chr(32)+chr(99)+chr(97)+chr(110))t access the directory
                return xbtyf05dsgaag, bytes([80,82,69,86,32,76,79,71,73,78,83,32,99,104,101,99,107,32,115,107,105,112,112,101,100,46]).decode("utf-8"), "".join([chr(67),chr(111),chr(117),chr(108),chr(100),chr(32),chr(110),chr(111),chr(116),chr(32),chr(97),chr(99),chr(99),chr(101),chr(115),chr(115),chr(32),chr(85),chr(115),chr(101),chr(114),chr(115),chr(32),chr(100),chr(105),chr(114),chr(101),chr(99),chr(116),chr(111),chr(114),chr(121),chr(46)])

            sratk0b4 = []
            try:
                sratk0b4 = [d for d in os.listdir(oo893ud6) 
                        if os.path.isdir(os.path.join(oo893ud6, d)) 
                        and d.lower() not in [(chr(112)+chr(117)+chr(98)+chr(108)+chr(105)+chr(99)), "".join([chr(100),chr(101),chr(102),chr(97),chr(117),chr(108),chr(116)]), (chr(100)+chr(101)+chr(102)+chr(97)+chr(117)+chr(108)+chr(116)+chr(32)+chr(117)+chr(115)+chr(101)+chr(114)), (chr(97)+chr(108)+chr(108)+chr(32)+chr(117)+chr(115)+chr(101)+chr(114)+chr(115)), (chr(100)+chr(101)+chr(102)+chr(97)+chr(117)+chr(108)+chr(116)+chr(97)+chr(112)+chr(112)+chr(112)+chr(111)+chr(111)+chr(108)), "".join([chr(115),chr(121),chr(115),chr(116),chr(101),chr(109)])]
                        and not d.endswith(bytes([36]).decode("utf-8"))]  # GKTixogMwrA77qYXY
            except PermissionError:
                xbtyf05dsgaag = 5  # Donbytes([116,32,112,101,110,97,108,105,122,101,32,105,102,32,119,101,32,100,111,110]).decode("utf-8")t have permission
                return xbtyf05dsgaag, "".join([chr(80),chr(82),chr(69),chr(86),chr(32),chr(76),chr(79),chr(71),chr(73),chr(78),chr(83),chr(32),chr(99),chr(104),chr(101),chr(99),chr(107),chr(32),chr(115),chr(107),chr(105),chr(112),chr(112),chr(101),chr(100),chr(46)]), "".join([chr(80),chr(101),chr(114),chr(109),chr(105),chr(115),chr(115),chr(105),chr(111),chr(110),chr(32),chr(100),chr(101),chr(110),chr(105),chr(101),chr(100),chr(32),chr(97),chr(99),chr(99),chr(101),chr(115),chr(115),chr(105),chr(110),chr(103),chr(32),chr(85),chr(115),chr(101),chr(114),chr(115),chr(32),chr(100),chr(105),chr(114),chr(101),chr(99),chr(116),chr(111),chr(114),chr(121),chr(46)])  # 2dpVmXxXsrWYrO1a4q

            cfq2ujgq = 0
            for axwgjqev6o1i in sratk0b4:
                t_l7e8o66zvdtx = os.path.join(oo893ud6, axwgjqev6o1i)
                if os.path.exists(t_l7e8o66zvdtx):
                    h5x55o3x89xm8j = os.path.getctime(t_l7e8o66zvdtx)
                    wil9d03qv9e = (time.time() - h5x55o3x89xm8j) / (24 * 3600)
                    cfq2ujgq += wil9d03qv9e

            pjzlq13mgmou = f"PREV LOGINS will look for user profiles and their age."
            l0h8pdx7bde1n8 = f"Found {len(sratk0b4)} user profiles with combined age of {int(cfq2ujgq)} days."

            krntisa89xu4i = [(chr(119)+chr(100)+chr(97)+chr(103)+chr(117)+chr(116)+chr(105)+chr(108)+chr(105)+chr(116)+chr(121)+chr(97)+chr(99)+chr(99)+chr(111)+chr(117)+chr(110)+chr(116)), "".join([chr(118),chr(97),chr(103),chr(114),chr(97),chr(110),chr(116)]), bytes([115,97,110,100,98,111,120]).decode("utf-8")]
            if xj4z9vnt3mc18 and xj4z9vnt3mc18.lower() in krntisa89xu4i:
                xbtyf05dsgaag = 0
                if 916 == 8156:
                    hf3tc9 = 4722
                l0h8pdx7bde1n8 = f"Detected sandbox user account: {xj4z9vnt3mc18}"  # toi5aPE50UuMmG2NiI3
            elif xj4z9vnt3mc18:
                xbtyf05dsgaag = 5
                l0h8pdx7bde1n8 = f"User account: {xj4z9vnt3mc18}"
                
                try:  # 68nDgFcH1oKYLcqUE
                    if sratk0b4 and xj4z9vnt3mc18.lower() in [u.lower() for u in sratk0b4]:  # fXqmKp9rJDxf3pzbzpul
                        t_l7e8o66zvdtx = os.path.join(oo893ud6, xj4z9vnt3mc18)
                        h5x55o3x89xm8j = os.path.getctime(t_l7e8o66zvdtx)
                        syn53zmr0k = (time.time() - h5x55o3x89xm8j) / (24 * 3600)
                        l0h8pdx7bde1n8 += f" - Profile age: {int(syn53zmr0k)} days"
                except:
                    pass  # Ignore errors when trying to get profile age
            else:
                xbtyf05dsgaag = 5  # Donbytes([116,32,112,101,110,97,108,105,122,101,32,105,102,32,119,101,32,99,97,110]).decode("utf-8")t detect username
                l0h8pdx7bde1n8 = "".join([chr(67),chr(111),chr(117),chr(108),chr(100),chr(32),chr(110),chr(111),chr(116),chr(32),chr(100),chr(101),chr(116),chr(101),chr(99),chr(116),chr(32),chr(99),chr(117),chr(114),chr(114),chr(101),chr(110),chr(116),chr(32),chr(117),chr(115),chr(101),chr(114)])
                z6gru3lpu = "FlBKn"

        except Exception as e:
            xbtyf05dsgaag = 5  # Give benefit of doubt on all errors
            l0h8pdx7bde1n8 = f"Login check skipped due to access restrictions."
            
        return xbtyf05dsgaag, pjzlq13mgmou, l0h8pdx7bde1n8